From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: X-Spam-Status: No, score=-4.0 required=3.0 tests=ALL_TRUSTED,BAYES_00 shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from localhost (dcvr.yhbt.net [127.0.0.1]) by dcvr.yhbt.net (Postfix) with ESMTP id 806801F61A for ; Tue, 17 Mar 2020 06:56:52 +0000 (UTC) From: Eric Wong To: cmogstored-public@yhbt.net Subject: [PATCH 1/2] http: reject non-chunked Transfer-Encoding Date: Tue, 17 Mar 2020 06:56:51 +0000 Message-Id: <20200317065652.10324-2-e@yhbt.net> In-Reply-To: <20200317065652.10324-1-e@yhbt.net> References: <20200317065652.10324-1-e@yhbt.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit List-Id: RFC 7230 3.3.3, point 3 states: > If a Transfer-Encoding header field > is present in a request and the chunked transfer coding is not > the final encoding, the message body length cannot be determined > reliably; the server MUST respond with the 400 (Bad Request) > status code and then close the connection. And no MogileFS client is known to send "gzip", "deflate", or "compress" as part of the Transfer-Encoding, so we'll only accept "chunked". --- http_parser.rl | 6 +++++- test/http-parser-1.c | 9 +++++++++ test/http_put.rb | 11 +++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/http_parser.rl b/http_parser.rl index 9f848b0..0685d27 100644 --- a/http_parser.rl +++ b/http_parser.rl @@ -112,7 +112,11 @@ static char *skip_header(struct mog_http *http, char *buf, const char *pe) } eor @ { http->_p.has_range = 1; }; transfer_encoding_chunked = "Transfer-Encoding:"i sep - "chunked"i eor > { http->_p.chunked = 1; }; + # XXX we don't know how to deal with "gzip", "deflate", or + # "compress" as described in RFC 7230, so reject them, here. + "chunked"i + $! { errno = EINVAL; fbreak; } + eor @ { http->_p.chunked = 1; }; trailer = "Trailer:"i sep (("Content-MD5"i @ { http->_p.has_md5 = 1; }) | header_name | ',') diff --git a/test/http-parser-1.c b/test/http-parser-1.c index 4b4d4f9..5c19529 100644 --- a/test/http-parser-1.c +++ b/test/http-parser-1.c @@ -157,6 +157,15 @@ int main(void) && "buffer repositioned to body start"); assert(!http->_p.usage_txt && "not a usage request"); } + if ("HTTP/1.1 PUT Transfer-Encoding: bogus header") { + buf_set("PUT /foo HTTP/1.1\r\n" + "Host: 127.6.6.6\r\n" + "Transfer-Encoding: bogus\r\n" + "\r\n" + "16\r\npartial..."); + state = mog_http_parse(http, buf, len); + assert(state == MOG_PARSER_ERROR && "parser not errored"); + } if ("HTTP/1.1 PUT with Content-Range") { buf_set("PUT /foo HTTP/1.1\r\n" diff --git a/test/http_put.rb b/test/http_put.rb index 21d65c7..0479629 100644 --- a/test/http_put.rb +++ b/test/http_put.rb @@ -160,6 +160,17 @@ def test_put_content_len_overflow assert( ! File.exist?("#@tmpdir/dev666/foo") ) end + def test_put_bogus + max = 0xffffffff << 64 + req = "PUT /dev666/foo HTTP/1.1\r\n" \ + "Transfer-Encoding: bogus\r\n" \ + "\r\n" + @client.write(req) + resp = @client.read + assert_match(%r{\AHTTP/1\.1 400 Bad Request\r\n}, resp) + assert( ! File.exist?("#@tmpdir/dev666/foo") ) + end + def test_put_range_beg_overflow max = 0xffffffff << 64 req = "PUT /dev666/foo HTTP/1.1\r\n" \